It is legit, but you need to prove your losses due to the breach.